x64dbg MCP
x64dbg MCP Server Plugin
An x64dbg and x32dbg plugin with an MCP server of 79 tools and 11 Claude Code commands for crash analysis, tracing and memory dumps
- 534 ★ on the repository
- Last commit
- MIT
Broad access
Why this level
- Controls the debugger: it launches programs, stops processes and reads memory and registers
- With rights enabled in config.json, the agent writes to memory and registers and runs debugger scripts
- The server can be opened to a network, and token checking is off by default
Install
- Works in
Manual install
/install-plugin path/to/x64dbg-mcp/skillsInstalls 11 commands and the `x64dbg-reverse-engineering` skill from the cloned repository. The debugger plugin server must already be running.
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- Controls the debugger: it launches programs, stops processes and reads memory and registers
- With rights enabled in config.json, the agent writes to memory and registers and runs debugger scripts
- The server can be opened to a network, and token checking is off by default
This is third-party code. Review the repository files before installing.
What it does
The C++ plugin loads into the x64dbg or x32dbg debugger and starts an MCP HTTP server inside it, by default on `127.0.0.1:3000`. An agent connects at `/mcp` (streamable HTTP) or `/sse` (legacy SSE) and gets 79 tools: starting and stopping the debugged program, stepping, software, hardware, memory, conditional and logging breakpoints, reading and writing registers and memory, disassembly, symbols, modules, threads, the stack, bookmarks and expressions. A separate group dumps a module, detects the entry point and the packer, and captures and compares state snapshots. Besides tools the server serves 7 resources (debugger state, registers, modules, threads, memory map, breakpoints, stack), 8 resource templates and 10 ready prompts. The `skills` folder holds a Claude Code plugin with the `x64dbg-reverse-engineering` skill and 11 commands: `/debug-session`, `/analyze-crash`, `/unpack`, `/trace-function`, `/find-vuln`, `/reverse-algo`, `/api-monitor`, `/patch-code`, `/hunt-strings`, `/compare-state` and `/dump-memory`. Each command walks the agent through phases and calls the needed tools in order.
Who it is for. For Windows developers, security researchers and analysts who debug their own or authorized programs and want an agent to take over routine work in x64dbg.
Good fit when
- A program crashes and you need the cause from the crash address: call stack, registers and disassembly around the instruction
- You need to trace a function call, log its arguments through a breakpoint and compare state before and after
- You need a module dump from the memory of a running process for further analysis in another tool
- You want to log Windows API calls by group: processes, network, files
- You need to find strings in a process and the references to them to reach the right code quickly
Not a fit when
- You work on macOS or Linux: the plugin builds and runs only on Windows 10 and 11 inside x64dbg
- You analyze someone else's program and have no permission from the owner or a license for it
- You need static analysis and decompilation without running the program: ghidramcp covers that
- Several agents must work with one debugger at once: the plugin accepts a single client connection
- You want a different plugin for the same debugger, also on Windows: the x64dbg-mcp-server entry describes it
Example request
The program crashed at address 0x401000. Stop it at that point, show the call stack and registers, then work out which instruction reads the wrong addressMCP
- Transport
- http, sse
- Authentication
- not required
Limitations
This is a dual-use tool: a debugger gives full control over a running process, and you may use it only on systems and data you have permission to access.
The build needs CMake 3.15 or newer, Visual Studio 2022 with the C++ workload and vcpkg. You need x64dbg or x32dbg build 2023 or newer, and the `.dp64` and `.dp32` plugins are not interchangeable.
The server listens on `127.0.0.1` by default, and token checking is off (`auth_enabled: false`). Memory writes, register writes and script execution are disabled in `config.json`, while breakpoint changes are allowed. For access from a local network you change the address to `0.0.0.0` and set allowlists of origins and hosts.
Operations require the debugger to be paused. The server is started by hand from the plugin menu unless `auto_start_mcp_on_plugin_load` is on. MIT License.
How to disable. Stop the server in the debugger menu under Plugins, MCP Server and delete the `x64dbg_mcp.dp64` or `x32dbg_mcp.dp32` plugin file from the `plugins` folder. Then remove the `x64dbg` block from the client config and disable the Claude Code plugin with the plugin manager.
FAQ
How do I connect an agent to the plugin?
Start the server from the x64dbg menu: Plugins, MCP Server, Start MCP HTTP Server. In the client set type `http` and address `http://127.0.0.1:3000/mcp`, or for older clients type `sse` and address `http://127.0.0.1:3000/sse`.
How do I install the Claude Code plugin with the commands?
Clone the repository and run `/install-plugin path/to/x64dbg-mcp/skills` in Claude Code. Alternatively copy the `skills` folder into `.claude/plugins/x64dbg-re` or start `claude --plugin-dir path/to/x64dbg-mcp/skills`.
Which write rights are off by default?
Memory writes (`allow_memory_write`), register writes (`allow_register_write`) and script execution (`allow_script_execution`). Breakpoint changes are allowed. The example list of allowed methods is limited to the `debug.*` and `memory.*` groups.
How do I open the server to another computer or a virtual machine?
Change the address to `0.0.0.0`, add the client origin to `origin_allowlist` and the server name or address to `host_allowlist`, turn on `auth_enabled` with a long token and restart the server. For internet access the authors advise a reverse proxy with TLS and access checks rather than publishing the port directly.
What does the /unpack command do?
It walks the agent through three phases: analyzing a packed file by section entropy and import count, finding the original program's entry point, and saving a dump with `dump_module`. The result is checked by analyzing the dump again.
Where are settings stored and how do I change them?
In `config.json` next to the plugin. You can also edit it without handling JSON: Plugins, MCP Server, Edit Config opens an editor with sections for server, security, permissions, runtime and logging. Restart the server after saving.
Discussion
No questions or reviews yet.
Related
MCP serversA native MCP plugin for the x64dbg debugger: the agent drives debugging over HTTP, sets breakpoints, steps through code, reads and patches memory
The official Hex-Rays MCP server: an agent opens IDA databases, runs Python inside them and reverses binaries, with plugins for Claude Code and Codex
A Ghidra extension with an MCP server: an agent reads pseudocode and disassembly, builds call graphs and edits names, types and structures via 100 tools
MCP-Shield finds your MCP configs, connects to servers and scans tool descriptions for hidden commands, exfiltration channels and tool shadowing
An MCP server for the Ghidra disassembler: hundreds of tools for reverse engineering, decompilation, renaming, structures, emulation and debugging
MCP server and Ghidra plugin that lets an agent decompile binaries, follow cross-references and rename functions in an open project
Comparison with similar tools
Entries that share the main search query, and how they differ.
| Entry | Official | Authentication | Repository stars | Main difference |
|---|---|---|---|---|
| x64dbg MCP (this entry) | no | not required | 534 | |
| x64dbg-MCP Server | no | API key | 2,591 | a different x64dbg plugin, written in Zig, with a token and ports 9094 and 9095 by default |
| GhidraMCP | no | not required | 11,491 | an MCP server for Ghidra: static analysis and decompilation of binaries without running the program |
README in short
The repository covers the server features, building both plugin variants with the `build.bat` script and by hand through CMake, copying files into the debugger folders and starting from the menu. It walks through the `config.json` file, the settings editor, access modes from one computer, from a local network and over the internet, and common causes of connection failures. It has a JSON-RPC method list, a Python client example in the `examples` folder, a Chinese guide and a description of the Claude Code plugin with analysis workflow examples.